πŸ›‘ Cybersecurity & Privacy πŸ›‘ - News
25.9K subscribers
89.2K links
πŸ—ž The finest daily news on cybersecurity and privacy.

πŸ”” Daily releases.

πŸ’» Is your online life secure?

πŸ“© lalilolalo.dev@gmail.com
Download Telegram
β€Ό CVE-2020-6372 β€Ό

SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated PDF file received from untrusted sources which results in crashing of the application and becoming temporarily unavailable until the user restarts the application, this is caused due to Improper Input Validation.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2020-5642 β€Ό

Cross-site request forgery (CSRF) vulnerability in Live Chat - Live support version 3.1.0 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2020-7334 β€Ό

Improper privilege assignment vulnerability in the installer McAfee Application and Change Control (MACC) prior to 8.3.2 allows local administrators to change or update the configuration settings via a carefully constructed MSI configured to mimic the genuine installer. This version adds further controls for installation/uninstallation of software.

πŸ“– Read

via "National Vulnerability Database".
πŸ•΄ Microsoft Office 365 Accounts a Big Target for Attackers πŸ•΄

Just as they did with PowerShell for Windows, threat actors are abusing native O365 capabilities for lateral movement, command-and-control communication, and other malicious activity.

πŸ“– Read

via "Dark Reading".
❌ Carnival Corp. Ransomware Attack Affected Three Cruise Lines ❌

Hackers accessed personal information of guests, employees and crew for Carnival Cruise, Holland America and Seabourn as well as casino operations.

πŸ“– Read

via "Threat Post".
β€Ό CVE-2020-7327 β€Ό

Improperly implemented security check in McAfee MVISION Endpoint Detection and Response Client (MVEDR) prior to 3.2.0 may allow local administrators to execute malicious code via stopping a core Windows service leaving McAfee core trust component in an inconsistent state resulting in MVEDR failing open rather than closed

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2020-7326 β€Ό

Improperly implemented security check in McAfee Active Response (MAR) prior to 2.4.4 may allow local administrators to execute malicious code via stopping a core Windows service leaving McAfee core trust component in an inconsistent state resulting in MAR failing open rather than closed

πŸ“– Read

via "National Vulnerability Database".
❌ Barnes & Noble Hack: A Reading List for Phishers and Crooks ❌

Customers' lists of book purchases along with email addresses and more could have been exposed -- and that's a problem.

πŸ“– Read

via "Threat Post".
πŸ•΄ The Ruthless Cyber Chaos of Business Recovery πŸ•΄

Critical technology initiatives leveraging the best of technology solutions are the only way through the cyber chaos of 2020.

πŸ“– Read

via "Dark Reading".
🦿 Ransomware campaign threatens organizations with DDoS attacks 🦿

All the organizations that contacted security provider Radware after receiving an extortion letter were hit by Distributed Denial of Service attacks.

πŸ“– Read

via "Tech Republic".
β€Ό CVE-2020-4499 β€Ό

IBM Security Access Manager 9.0.7 and IBM Security Verify Access 10.0.0 could allow an unauthorized public Oauth client to bypass some or all of the authentication checks and gain access to applications. IBM X-Force ID: 182216.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2020-7744 β€Ό

This affects all versions of package com.mintegral.msdk:alphab. The Android SDK distributed by the company contains malicious functionality in this module that tracks: 1. Downloads from Google urls either within Google apps or via browser including file downloads, e-mail attachments and Google Docs links. 2. All apk downloads, either organic or not. Mintegral listens to download events in Android's download manager and detects if the downloaded file's url contains: a. google.com or comes from a Google app (the com.android.vending package) b. Ends with .apk for apk downloads In both cases, the module sends the captured data back to Mintegral's servers. Note that the malicious functionality keeps running even if the app is currently not in focus (running in the background).

πŸ“– Read

via "National Vulnerability Database".
❌ Broadvoice Leak Exposes 350M Records, Personal Voicemail Transcripts ❌

Companies that use Broadvoice's cloud-based VoIP platform may find their patients, customers, suppliers and partners to be impacted by a massive data exposure.

πŸ“– Read

via "Threat Post".
❌ Zoom Rolls Out End-to-End Encryption After Setbacks ❌

After backlash over false marketing around its encryption policies, Zoom will finally roll out end-to-end encryption next week.

πŸ“– Read

via "Threat Post".
🦿 Survey: 53% of young cybersecurity professionals fear replacement by automation 🦿

Cybersecurity professionals largely embrace automation, but half of younger employees worry that technology could make their roles obsolete, according to a new survey by Exabeam.

πŸ“– Read

via "Tech Republic".
β€Ό CVE-2020-6107 β€Ό

An exploitable information disclosure vulnerability exists in the dev_read functionality of F2fs-Tools F2fs.Fsck 1.13. A specially crafted f2fs filesystem can cause an uninitialized read resulting in an information disclosure. An attacker can provide a malicious file to trigger this vulnerability.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2020-6105 β€Ό

An exploitable code execution vulnerability exists in the multiple devices functionality of F2fs-Tools F2fs.Fsck 1.13. A specially crafted f2fs filesystem can cause Information overwrite resulting in a code execution. An attacker can provide a malicious file to trigger this vulnerability.

πŸ“– Read

via "National Vulnerability Database".
πŸ•΄ Overcoming the Challenge of Shorter Certificate Lifespans πŸ•΄

We could be in the middle of a major transition to shorter and shorter certificate life spans, which has significant implications for how IT organizations manage certificates across the enterprise.

πŸ“– Read

via "Dark Reading".
β€Ό CVE-2019-12411 β€Ό

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2020-13939 β€Ό

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.

πŸ“– Read

via "National Vulnerability Database".
πŸ” Proposed Modifications to the CCPA Issued πŸ”

Potential modifications to the CCPA include would change β€œDo Not Sell My Personal Information” requests and how companies provide notice when they collect information offline.

πŸ“– Read

via "Digital Guardian".